Chivo Wallet, El Salvador’s official cryptocurrency wallet, has dismissed reports of a hack involving its software source code and the data of over 5 million users associated with its KYC (Know Your Customer) procedures.
The wallet’s administration clarified that the security of its data has not been compromised.
In a press release, Chivo Wallet addressed allegations linking it to a data breach that allegedly exposed personal details of over 5 million Salvadorans. This leaked data included full names, unique identity numbers, dates of birth, addresses, phone numbers, emails, and photographs. It was speculated that this data was associated with the KYC processes required by the Salvadoran government for citizens to receive incentives offered at the wallet’s launch, such as $30 in Bitcoin.
Chivo Wallet refuted these claims, stating that the leaked data did not originate from their systems. They assured, “Our users’ data is secure, and there has been no breach of Chivo’s security.”
Additionally, Chivo responded to claims about a source code hack reported by the same entity that disclosed the large-scale database. They stated that the only files leaked were from a Chivo ATM that was stolen on March 21, 2023. These files contained information strictly related to the ATM’s operations and did not include any personal user data.
Chivo Wallet denounced the reports about this leak and its alleged link to its user data as “fake news,” noting that the original source of the data breach has not been identified.
Earlier this week, local cybersecurity project VenariX alerted the public to the leak via X, citing a post from CiberInteligenciaSV’s Telegram channel which preceded the release of the source code and VPN access.
This latest incident involved CiberInteligenciaSV posting snippets of the code used in Bitcoin Chivo Wallet ATMs throughout El Salvador. In their online message, the group stated, “This time I am bringing you the code that is inside the Bitcoin Chivo Wallet ATMs in El Salvador, remember that it is a government wallet, and as you know, we do not sell, we publish everything for free for you.”
The breach follows a separate incident a few days earlier when the same group released the personal data of 5.1 million Salvadorans, nearly the entire adult population. The hackers claimed that this action was to punish the Salvadoran government for its refusal to engage with them.
El Salvador made history in September 2021 by becoming the first country to adopt Bitcoin as legal tender.
